CVE-2026-100866: onefetch through 2.28.1 Terminal Escape Sequence Injection
onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, allowing terminal escape sequence injection. Attackers can embed ANSI/OSC escape sequences in project manifest version and name fields to manipulate terminal output, rewrite window titles, hide text, or trigger emulator-specific behavior when victims run onefetch.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users who run onefetch on repositories whose project manifest name or version fields can be attacker-controlled are exposed. Exploitation occurs when the crafted field value is written to the victim's terminal.
What does an attacker need to exploit it?
An attacker needs to place ANSI or OSC escape sequences in a project manifest's name or version field and induce a victim to run onefetch against that repository. No privileges are required, but user interaction is required because the victim must execute onefetch.
What is the practical impact?
The escape sequences can manipulate terminal output, hide text, rewrite terminal window titles, or invoke behavior specific to the victim's terminal emulator. The reported impact is limited to integrity; no confidentiality or availability impact is specified.
How can I tell whether a repository may be dangerous to inspect with onefetch?
Inspect project manifest name and version values for control characters or ANSI/OSC escape sequences before running onefetch. The issue affects onefetch through version 2.28.1.